[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftCbqKb6DQcT6HXX4r5d-vUoAv6c_6bfixvYCLT38e44":3,"g5a-family:redhat\u002Ffuse":172,"g5a-ex:redhat\u002Ffuse@*":173},{"success":4,"data":5},true,{"product":6,"versions":57,"topVulnerabilitiesByEpss":76,"kevVulnerabilities":137,"seoMetadata":150,"meta":169},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":56},"redhat","fuse",18,25,3,"2026-03-27",[14,18,22,26,28,30,32,34,36,38,40,42,44,46,48,50,52,54],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},"1.0",12,2,{"version":19,"cve_count":20,"kev_count":21,"has_kev":4},"1.0.0",4,1,{"version":23,"cve_count":21,"kev_count":24,"has_kev":25},"6.0.0",0,false,{"version":27,"cve_count":24,"kev_count":24,"has_kev":25},"6.1.0",{"version":29,"cve_count":24,"kev_count":24,"has_kev":25},"6.2.0",{"version":31,"cve_count":24,"kev_count":24,"has_kev":25},"6.2.1",{"version":33,"cve_count":24,"kev_count":24,"has_kev":25},"6.3.0",{"version":35,"cve_count":11,"kev_count":24,"has_kev":25},"7.0.0",{"version":37,"cve_count":24,"kev_count":24,"has_kev":25},"7.0.1",{"version":39,"cve_count":24,"kev_count":24,"has_kev":25},"7.1.0",{"version":41,"cve_count":21,"kev_count":24,"has_kev":25},"7.11",{"version":43,"cve_count":24,"kev_count":24,"has_kev":25},"7.2.0",{"version":45,"cve_count":21,"kev_count":24,"has_kev":25},"7.3.0",{"version":47,"cve_count":24,"kev_count":24,"has_kev":25},"7.3.1",{"version":49,"cve_count":24,"kev_count":24,"has_kev":25},"7.4.0",{"version":51,"cve_count":24,"kev_count":24,"has_kev":25},"7.4.1",{"version":53,"cve_count":21,"kev_count":24,"has_kev":25},"7.5.0",{"version":55,"cve_count":24,"kev_count":24,"has_kev":25},"7.5.1","Fuse by Redhat is a technology product with 18 tracked versions and 25 known security vulnerabilities including 3 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75],{"version":15,"cve_count":16,"kev_count":17,"has_kev":4},{"version":19,"cve_count":20,"kev_count":21,"has_kev":4},{"version":23,"cve_count":21,"kev_count":24,"has_kev":25},{"version":27,"cve_count":24,"kev_count":24,"has_kev":25},{"version":29,"cve_count":24,"kev_count":24,"has_kev":25},{"version":31,"cve_count":24,"kev_count":24,"has_kev":25},{"version":33,"cve_count":24,"kev_count":24,"has_kev":25},{"version":35,"cve_count":11,"kev_count":24,"has_kev":25},{"version":37,"cve_count":24,"kev_count":24,"has_kev":25},{"version":39,"cve_count":24,"kev_count":24,"has_kev":25},{"version":41,"cve_count":21,"kev_count":24,"has_kev":25},{"version":43,"cve_count":24,"kev_count":24,"has_kev":25},{"version":45,"cve_count":21,"kev_count":24,"has_kev":25},{"version":47,"cve_count":24,"kev_count":24,"has_kev":25},{"version":49,"cve_count":24,"kev_count":24,"has_kev":25},{"version":51,"cve_count":24,"kev_count":24,"has_kev":25},{"version":53,"cve_count":21,"kev_count":24,"has_kev":25},{"version":55,"cve_count":24,"kev_count":24,"has_kev":25},[77,85,92,97,102,107,114,120,125,131],{"cveId":78,"description":79,"publishedDate":80,"cvssScore":81,"cvssVersion":82,"severity":83,"isKev":4,"epssScore":84},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"v3.1","High",0.99968,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":89,"cvssVersion":82,"severity":90,"isKev":4,"epssScore":91},"CVE-2015-1427","The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.","2015-02-17",9.8,"Critical",0.99906,{"cveId":93,"description":94,"publishedDate":95,"cvssScore":89,"cvssVersion":82,"severity":90,"isKev":4,"epssScore":96},"CVE-2016-4437","Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","2016-06-07",0.93039,{"cveId":98,"description":99,"publishedDate":100,"cvssScore":89,"cvssVersion":82,"severity":90,"isKev":25,"epssScore":101},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",0.89792,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":89,"cvssVersion":82,"severity":90,"isKev":25,"epssScore":106},"CVE-2018-1270","Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.","2018-04-06",0.77476,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":111,"cvssVersion":82,"severity":112,"isKev":25,"epssScore":113},"CVE-2019-0201","An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.","2019-05-23",5.9,"Medium",0.09712,{"cveId":115,"description":116,"publishedDate":117,"cvssScore":118,"cvssVersion":82,"severity":83,"isKev":25,"epssScore":119},"CVE-2017-7957","XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003Cvoid\u002F>\") call.","2017-04-29",7.5,0.04928,{"cveId":121,"description":122,"publishedDate":123,"cvssScore":118,"cvssVersion":82,"severity":83,"isKev":25,"epssScore":124},"CVE-2024-1635","A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. \r\n\r\nAt HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.","2024-02-19",0.04572,{"cveId":126,"description":127,"publishedDate":128,"cvssScore":129,"cvssVersion":82,"severity":83,"isKev":25,"epssScore":130},"CVE-2019-10174","A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.","2019-11-25",8.8,0.03089,{"cveId":132,"description":133,"publishedDate":134,"cvssScore":135,"cvssVersion":82,"severity":112,"isKev":25,"epssScore":136},"CVE-2018-1199","Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.","2018-03-16",5.3,0.02917,[138,143,146],{"cveId":86,"description":87,"publishedDate":88,"cvssScore":89,"severity":90,"isKev":4,"epssScore":91,"cisaVulnName":139,"cisaDateAdded":140,"cisaShortDescription":141,"cisaRequiredAction":142},"Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability","2022-03-25","The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.","Apply updates per vendor instructions.",{"cveId":78,"description":79,"publishedDate":80,"cvssScore":81,"severity":83,"isKev":4,"epssScore":84,"cisaVulnName":144,"cisaDateAdded":140,"cisaShortDescription":145,"cisaRequiredAction":142},"Apache Tomcat Remote Code Execution Vulnerability","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":93,"description":94,"publishedDate":95,"cvssScore":89,"severity":90,"isKev":4,"epssScore":96,"cisaVulnName":147,"cisaDateAdded":148,"cisaShortDescription":149,"cisaRequiredAction":142},"Apache Shiro Code Execution Vulnerability","2021-11-03","Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the \"remember me\" feature.",{"title":151,"metaDescription":152,"keywords":153,"structuredData":154},"Fuse by Redhat - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Fuse by Redhat covering 18 versions with 25 tracked vulnerabilities including 2 critical and 1 high-severity issues and 3 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Fuse vulnerabilities, Fuse security, Fuse CVE, Redhat Fuse, Fuse threat intelligence, Redhat security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Fuse KEV, Fuse exploited vulnerabilities",{"@context":155,"@type":156,"name":157,"description":152,"url":158,"manufacturer":159,"applicationCategory":163,"softwareVersion":164,"mainEntity":165},"https:\u002F\u002Fschema.org","SoftwareApplication","Fuse","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fredhat\u002Ffuse",{"@type":160,"name":161,"url":162},"Organization","Redhat","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fredhat","Security Software","18 versions tracked",{"@type":166,"name":167,"description":168,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Fuse Security Vulnerabilities","Security vulnerabilities affecting Fuse by Redhat",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":170,"apiVersion":171},"2026-10-17T14:28:20.855Z","3.0",[],{"rows":174,"total":11,"capped":25,"failed":17},[175,179,182],{"cveId":86,"name":139,"severity":90,"cvss":89,"added":140,"epss":91,"published":176,"ranges":177,"checked":4,"hits":178,"covers":25},"2015-02-17T15:59:04.56",[19],[],{"cveId":78,"name":144,"severity":83,"cvss":81,"added":140,"epss":84,"published":80,"ranges":180,"hits":181,"checked":25,"covers":25},[],[],{"cveId":93,"name":147,"severity":90,"cvss":89,"added":148,"epss":96,"published":95,"ranges":183,"hits":184,"checked":25,"covers":25},[],[]]